IMDSv1 check policy

tenable · Dec 2, 2020 · 433415c · 433415c
1 parent 2d1374b
commit 433415c
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/pkg/policies/opa/rego/aws/aws_instance/AC-AWS-NS-IN-M-1172.json b/pkg/policies/opa/rego/aws/aws_instance/AC-AWS-NS-IN-M-1172.json
@@ -0,0 +1,10 @@
+{
+    "name": "ec2UsingIMDSv1",
+    "file": "ec2UsingIMDSv1.rego",
+    "template_args": null,
+    "severity": "MEDIUM",
+    "description": "Ensure there are no ECS instances using IMDSv1",
+    "reference_id": "AC-AWS-NS-IN-M-1172",
+    "category": "Unknown",
+    "version": 1
+}
diff --git a/pkg/policies/opa/rego/aws/aws_instance/ec2UsingIMDSv1.rego b/pkg/policies/opa/rego/aws/aws_instance/ec2UsingIMDSv1.rego
@@ -0,0 +1,13 @@
+package accurics
+
+ec2UsingIMDSv1[api.id] {
+  api := input.aws_instance[_]
+  not api.config.metadata_options
+}
+
+ec2UsingIMDSv1[api.id] {
+  api := input.aws_instance[_]
+  value := api.config.metadata_options[_]
+  not value.http_endpoint == "disabled"
+  not value.http_tokens == "required"
+}